MoreExam
1. Question Content...
EXPLANATION
Answer: X - EXPLANATION Content.
Question1: A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security To BEST complete this task, the analyst should place the:
Question2: The security team at a large corporation is helping the payment-processing team to prepare for a regulatory compliance audit and meet the following objectives:Reduce the number of potential findings by the auditors.Limit the scope of the audit to only devices used by the payment-processing team for activities directly impacted by the regulations.Prevent the external-facing web infrastructure used by other teams from coming into scope.Limit the amount of exposure the company will face if the systems used by the payment-processing team are compromised.Which of the following would be the MOST effective way for the security team to meet these objectives?
Question3: An organization has specific technical nsk mitigation configurations that must be implemented before a new server can be approved for production Several critical servers were recently deployed with the antivirus missing unnecessary ports disabled and insufficient password complexity Which of the following should the analyst recommend to prevent a recurrence of this risk exposure?
Question4: During a review of recent network traffic, an analyst realizes the team has seen this same traffic multiple times in the past three weeks, and it resulted in confirmed malware activity The analyst also notes there is no other alert in place for this traffic After resolving the security incident, which of the following would be the BEST action for the analyst to take to increase the chance of detecting this traffic in the future?
Question5: A security analyst was alerted to a tile integrity monitoring event based on a change to the vhost-paymonts .conf file The output of the diff command against the known-good backup reads as followsWhich of the following MOST likely occurred?
Question6: While conducting a network infrastructure review, a security analyst discovers a laptop that is plugged into a core switch and hidden behind a desk.The analyst sees the following on the laptop's screen:Which of the following is the BEST action for the security analyst to take?
Question7: Which of the following is the BEST way to gather patch information on a specific server?
Question8:
Question9:
Question10: A security analyst is investigating a system compromise. The analyst verities the system was up to date on OS patches at the time of the compromise. Which of the following describes the type of vulnerability that was MOST likely expiated?
Question11:
Question12: The inability to do remote updates of certificates. keys software and firmware is a security issue commonly associated with:
Question13: An executive assistant wants to onboard a new cloud based product to help with business analytics and dashboarding. When of the following would be the BEST integration option for the service?
Question14:
Question15:
Question16: As part of an exercise set up by the information security officer, the IT staff must move some of the network systems to an off-site facility and redeploy them for testing. All staff members must ensure their respective systems can power back up and match their gold image. If they find any inconsistencies, they must formally document the information.Which of the following BEST describes this test?
Question17:
Question18:
Question19: You are a penetration tester who is reviewing the system hardening guidelines for a company. Hardening guidelines indicate the following.There must be one primary server or service per device.Only default port should be usedNon- secure protocols should be disabled.The corporate internet presence should be placed in a protected subnetInstructions :Using the available tools, discover devices on the corporate network and the services running on these devices.You must determineip address of each deviceThe primary server or service each deviceThe protocols that should be disabled based on the hardening guidelines
Question20: An organization developed a comprehensive incident response policy. Executive management approved the policy and its associated procedures. Which of the following activities would be MOST beneficial to evaluate personnel's familiarity with incident response procedures?
Question21: A security analyst needs to identify possible threats to a complex system a client is developing. Which of the following methodologies would BEST address this task?
Question22: An analyst has received a notification about potential malicious activity against a web server. The analyst logs in to a central log collection server and runs the following command: "cat access.log.1 | grep "union". The output shown below appears:<68.71.54.117> - - [31/Jan/2020:10:02:31 -0400] "Get /cgi-bin/backend1.sh?id=%20union%20select%20192.168.60.50 HTTP/1.1" Which of the following attacks has occurred on the server?
Question23: A security analyst needs to reduce the overall attack surface.Which of the following infrastructure changes should the analyst recommend?
Question24: As part of a review of modern response plans, which of the following is MOST important for an organization lo understand when establishing the breach notification period?
Question25: An internally developed file-monitoring system identified the following except as causing a program to crash often:Which of the following should a security analyst recommend to fix the issue?
Question26: Which of the following is the BEST way to share incident-related artifacts to provide non-repudiation?
Question27: In system hardening, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies?
Question28: A security analyst is reviewing the network security monitoring logs listed below:Which of the following is the analyst MOST likely observing? (Select TWO).
Question29:
Question30: A user reports the system is behaving oddly following the installation of an approved third-party software application. The application executable was sourced from an internal repository Which of the following will ensure the application is valid?
Question31:
Question32:
Question33: The computer incident response team at a multinational company has determined that a breach of sensitive data has occurred in which a threat actor has compromised the organization's email system. Per the incident response procedures, this breach requires notifying the board immediately. Which of the following would be the BEST method of communication?
Question34: Which of the following technologies can be used to house the entropy keys for disk encryption on desktops and laptops?
Question35: While monitoring the information security notification mailbox, a security analyst notices several emails were repotted as spam. Which of the following should the analyst do FIRST?
Question36: Approximately 100 employees at your company have received a phishing email. As a security analyst you have been tasked with handling this situation.INSTRUCTIONSReview the information provided and determine the following:1. How many employees clicked on the link in the phishing email?2. On how many workstations was the malware installed?3. What is the executable file name or the malware?
Question37: An organization is experiencing issues with emails that are being sent to external recipients Incoming emails to the organization are working fine. A security analyst receives the following screenshot ot email error from the help desk.The analyst the checks the email server and sees many of the following messages in the logs.Error 550 - Message rejectedWhich of the following is MOST likely the issue?
Question38:
Question39: During a forensic investigation, a security analyst reviews some Session Initiation Protocol packets that came from a suspicious IP address. Law enforcement requires access to a VoIP call that originated from the suspicious IP address. Which of the following should the analyst use to accomplish this task?
Question40: A company's security administrator needs to automate several security processes related to testing for the existence of changes within the environment Conditionally other processes will need to be created based on input from prior processes Which of the following is the BEST method for accomplishing this task?
Question41: A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integration intelligence into hunt operations?
Question42:
Question43:
Question44: A security analyst reviews SIEM logs and detects a well-known malicious executable running in a Windows machine The up-to-date antivirus cannot detect the malicious executable Which of the following is the MOST likely cause of this issue?
Question45:
Question46: Which of the following is the use of tools to simulate the ability for an attacker to gain access to a specified network?
Question47: After receiving reports latency, a security analyst performs an Nmap scan and observes the following output:Which of the following suggests the system that produced output was compromised?
Question48:
Question49: While preparing of an audit of information security controls in the environment an analyst outlines a framework control that has the following requirements:* All sensitive data must be classified* All sensitive data must be purged on a quarterly basis* Certificates of disposal must remain on file for at least three years This framework control is MOST likely classified as:
Question50:
Question51:
Question52:
Question53: A company's data is still being exfiltered to business competitors after the implementation of a DLP solution. Which of the following is the most likely reason why the data is still being compromised?
Question54: After a series of Group Policy Object updates, multiple services stopped functioning. The systems administrator believes the issue resulted from a Group Policy Object update but cannot validate which update caused the Issue. Which of the following security solutions would resolve this issue?
Question55:
Question56: A company has alerted planning the implemented a vulnerability management procedure. However, to security maturity level is low, so there are some prerequisites to complete before risk calculation and prioritization. Which of the following should be completed FIRST?
Question57:
Question58: An organization's Chief Information Security Officer (CISO) has asked department leaders to coordinate on communication plans that can be enacted in response to different cybersecurity incident triggers.Which of the following is a benefit of having these communication plans?
Question59: A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised. When viewing the capture in a packet analyzer, the analyst sees the following:Which of the following can the analyst conclude?
Question60:
Question61: An analyst determines a security incident has occurred Which of the following is the most appropnate NEXT step in an incident response plan?
Question62: A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current functionality?
Question63:
Question64: A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability Company policy prohibits using portable media or mobile storage The security analyst is trying to determine which user caused the malware to get onto the system Which of the following registry keys would MOST likely have this information?
Question65:
Question66: Which of the following sources will provide the MOST relevant threat intelligence data to the security team of a dental care network?
Question67: A security analyst sees the following OWASP ZAP output from a scan that was performed against a modern version of Windows while testing for client-side vulnerabilities:Which of the following is the MOST likely solution to the listed vulnerability?
Question68: Which of the following is a best practice when sending a file/data to another individual in an organization?
Question69: A secutily analyst is reviewing WAF alerts and sees the following request:Which of the following BEST describes the attack?
Question70:
Question71: A company frequently expenences issues with credential stuffing attacks Which of the following is the BEST control to help prevent these attacks from being successful?
Question72: A security analyst is conducting a post-incident log analysis to determine which indicators can be used to detect further occurrences of a data exfiltration incident. The analyst determines backups were not performed during this time and reviews the following:Which of the following should the analyst review to find out how the data was exfilltrated?
Question73:
Question74: An organization has the following risk mitigation policy:Risks with a probability of 95% or greater will be addressed before all others regardless of the impact.All other prioritization will be based on risk value.The organization has identified the following risks:Which of the following is the order of priority for risk mitigation from highest to lowest?
Question75:
Question76: Which of the following BEST describes what an organizations incident response plan should cover regarding how the organization handles public or private disclosures of an incident?
Question77:
Question78: Forming a hypothesis, looking for indicators of compromise, and using the findings to proactively improve detection capabilities are examples of the value of:
Question79: The threat intelligence department recently learned of an advanced persistent threat that is leveraging a new strain of malware, exploiting a system router. The company currently uses the same device mentioned in the threat report. Which of the following configuration changes would BEST improve the organization's security posture?
Question80: A team of security analysis has been alerted to potential malware activity. The initial examination indicates one of the affected workstations on beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445. Which of the following should be the team's NEXT step during the detection phase of this response process?
Question81: Which of the following should a database administrator implement to BEST protect data from an untrusted server administrator?
Question82: An organization's internal department frequently uses a cloud provider to store large amounts of sensitive dat a. A threat actor has deployed a virtual machine to at the use of the cloud hosted hypervisor, the threat actor has escalated the access rights. Which of the following actions would be BEST to remediate the vulnerability?
Question83: Which of the following types of controls defines placing an ACL on a file folder?
Question84:
Question85: A security analyst is reviewing the following requirements (or new time clocks that will be installed in a shipping warehouse:* The clocks must be configured so they do not respond to ARP broadcasts.* The server must be configured with static ARP entries for each clock.Which of the following types of attacks will this configuration mitigate?
Question86:
Question87:
Question88: A small marketing firm uses many SaaS applications that hold sensitive information The firm has discovered terminated employees are retaining access to systems for many weeks after their end date. Which of the following would BEST resolve the issue of lingering access?
Question89: A cybersecurity analyst is dissecting an intrusion down to the specific techniques and wants to organize them in a logical manner. Which of the following frameworks would BEST apply in this situation?
Question90:
Question91: A business recently acquired a software company. The software company's security posture is unknown. However, based on an assessment, there are limited security controls. No significant security monitoring exists. Which of the following is the NEXT step that should be completed to obtain information about the software company's security posture?
Question92:
Question93: An organization wants to mitigate against risks associated with network reconnaissance. ICMP is already blocked at the firewall; however, a penetration testing team has been able to perform reconnaissance against the organization's network and identify active hosts. An analyst sees the following output from a packet capture:Which of the following phrases from the output provides information on how the testing team is successfully getting around the ICMP firewall rule?
Question94:
Question95: Which of the following sources would a security analyst rely on to provide relevant and timely threat information concerning the financial services industry?
Question96: After examine a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following techniques is the analyst using?
Question97:
Question98: While planning segmentation for an ICS environment, a security engineer determines IT resources will need access to devices within the ICS environment without compromising security.To provide the MOST secure access model in this scenario, the jumpbox should be .
Question99:
Question100:
Question101: Which of the following policies would state an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?
Question102:
Question103:
Question104: A host is spamming the network unintentionally. Which of the following control types should be used to address this situation?
Question105:
Question106:
Question107:
Question108:
Question109:
Question110: An organization wants to ensure the privacy of the data that is on its systems Full disk encryption and DLP are already in use Which of the following is the BEST option?
Question111: A forensics investigator is analyzing a compromised workstation. The investigator has cloned the hard drive and needs to verify that a bit-level image copy of a hard drive is an exact clone of the original hard drive that was collected as evidence. Which of the following should the investigator do?
Question112:
Question113: Which of the following is MOST important when developing a threat hunting program?
Question114: SIMULATIONMalware is suspected on a server in the environment.The analyst is provided with the output of commands from servers in the environment and needs to review all output files in order to determine which process running on one of the servers may be malware.INSTRUCTIONSServers 1, 2, and 4 are clickable. Select the Server and the process that host the malware.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question115: As part of the senior leadership team's ongoing nsk management activities the Chief Information Security Officer has tasked a security analyst with coordinating the right training and testing methodology to respond to new business initiatives or significant changes to existing ones The management team wants to examine a new business process that would use existing infrastructure to process and store sensitive data Which of the following would be appropnate for the security analyst to coordinate?
Question116: A security analyst is reviewing the following log from an email security service.Which of the following BEST describes the reason why the email was blocked?
Question117: As part of a merger with another organization, a Chief Information Security Officer (CISO) is working with an assessor to perform a risk assessment focused on data privacy compliance. The CISO is primarily concerned with the potential legal liability and fines associated with data privacy. Based on the CISO's concerns, the assessor will MOST likely focus on:
Question118: A security analyst is building a malware analysis lab. The analyst wants to ensure malicious applications are not capable of escaping the virtual machines and pivoting to other networks.To BEST mitigate this risk, the analyst should use .
Question119: A developer is working on a program to convert user-generated input in a web form before it is displayed by the browser. This technique is referred to as:
Question120: Which of the following would a security engineer recommend to BEST protect sensitive system data from being accessed on mobile devices?
Question121: Joe, a penetration tester, used a professional directory to identify a network administrator and ID administrator for a client's company. Joe then emailed the network administrator, identifying himself as the ID administrator, and asked for a current password as part of a security exercise. Which of the following techniques were used in this scenario?
Question122: A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures. The analyst observes the following plugin output:The analyst uses the vendor's website to confirm the oldest supported version is correct. Which of the following BEST describes the situation?
Question123:
Question124: A company is moving from the use of web servers hosted in an internal datacenter to a containerized cloud platform. An analyst has been asked to identify indicators of compromise in the containerized environment. Which of the following would BEST indicate a running container has been compromised?
Question125: The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones. The analyst runs the following command on the new server.Given the output, which of the following should the security analyst check NEXT?
Question126:
Question127: A cybersecurity analyst is supposing an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?
Question128: A new vanant of malware is spreading on ihe company network using TCP 443 to contact its command-and-control server The domain name used for callback continues to change, and the analyst is unable to predict future domain name variance Which of the following actions should the analyst take to stop malicious communications with the LEAST disruption to service?
Question129:
Question130:
Question131: The Chief Information Officer (CIO) of a large healthcare institution is concerned about all machines having direct access to sensitive patient information. Which of the following should the security analyst implement to BEST mitigate the risk of sensitive data exposure?
Question132:
Question133: Clients are unable to access a company's API to obtain pricing data. An analyst discovers sources other thanclients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs?
Question134:
Question135: A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT.Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?
Question136:
Question137:
Question138:
Question139:
Question140: A security analyst has discovered trial developers have installed browsers on all development servers in the company's cloud infrastructure and are using them to browse the Internet. Which of the following changes should the security analyst make to BEST protect the environment?
Question141: A security analyst is supporting an embedded software team. Which of the following is the BEST recommendation to ensure proper error handling at runtime?
Question142: A security analyst is reviewing the following DNS logs as part of security-monitoring activities:Which of the following MOST likely occurred?
Question143: You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not.The company's hardening guidelines indicate the following:* TLS 1.2 is the only version of TLS running.* Apache 2.4.18 or greater should be used.* Only default ports should be used.INSTRUCTIONSUsing the supplied data, record the status of compliance with the company's guidelines for each server.The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.
Question144:
Question145:
Question146: An organization has the following policy statements:* AlI emails entering or leaving the organization will be subject to inspection for malware, policy violations, and unauthorized coolant.* AM network activity will be logged and monitored.* Confidential data will be tagged and tracked* Confidential data must never be transmitted in an unencrypted form.* Confidential data must never be stored on an unencrypted mobile device.Which of the following is the organization enforcing?
Question147:
Question148: Ransomware is identified on a company's network that affects both Windows and MAC hosts. The command and control channel for encryption for this variant uses TCP ports from 11000 to 65000. The channel goes to good1. Iholdbadkeys.com, which resolves to IP address 72.172.16.2.Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the data on connected network drives while causing the least disruption to normal Internet traffic?
Question149: A security analyst needs to provide a copy of a hard drive for forensic analysis. Which of the following would allow the analyst to perform the task?A)B)C)D)
Question150: A critical server was compromised by malware, and all functionality was lost. Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit. Which of the following should a security analyst perform to restore functionality quickly?
Question151: During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation . Which of the following would cause the analyst to further review the incident?A)B)C)D)E)
Question152:
Question153:
Question154:
Question155: A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful. Which of the following should the security analyst perform NEXT?
Question156: A security analyst working in the SOC recently discovered Balances m which hosts visited a specific set of domains and IPs and became infected with malware. Which of the following is the MOST appropriate action to take in the situation?
Question157: Which of the following describes the mam difference between supervised and unsupervised machine-learning algorithms that are used in cybersecurity applications?
Question158: A security analyst receives an alert that highly sensitive information has left the company's network Upon investigation, the analyst discovers an outside IP range has had connections from three servers more than 100 times m the past month The affected servers are virtual machines Which of the following is the BEST course of action?
Question159: A security analyst implemented a solution that would analyze the attacks that the organization's firewalls failed to prevent. The analyst used the existing systems to enact the solution and executed the following command.S sudo nc -1 -v -c maildemon . py 25 caplog, txtWhich of the following solutions did the analyst implement?
Question160: A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked.Which of the following methods would be MOST appropriate to use?
Question161: A company wants to reduce the cost of deploying servers to support increased network growth. The company is currently unable to keep up with the demand, so it wants to outsource the infrastructure to a cloud-based solution.Which of the following is the GREATEST threat for the company to consider when outsourcing its infrastructure?
Question162:
Question163: Which of the following assessment methods should be used to analyze how specialized software performs during heavy loads?
Question164: A customer notifies a security analyst that a web application is vulnerable to information disclosure The analyst needs to indicate the seventy of the vulnerability based on its CVSS score, which the analyst needs to calculate When analyzing the vulnerability the analyst realizes that tor the attack to be successful, the Tomcat configuration file must be modified Which of the following values should the security analyst choose when evaluating the CVSS score?
Question165: A small business does not have enough staff in the accounting department to segregate duties. The controller writes the checks for the business and reconciles them against the ledger. To ensure there is no fraud occurring, the business conducts quarterly reviews in which a different officer in the business compares all the cleared checks against the ledger. Which of the following BEST describes this type of control?
Question166: A security analyst discovers a vulnerability on an unpatched web server that is used for testing machine learning on Bing Data sets. Exploitation of the vulnerability could cost the organization $1.5 million in lost productivity. The server is located on an isolated network segment that has a 5% chance of being compromised. Which of the following is the value of this risk?
Question167: A security analyst received a SIEM alert regarding high levels of memory consumption for a critical system. After several attempts to remediate the issue, the system went down. A root cause analysis revealed a bad actor forced the application to not reclaim memory. This caused the system to be depleted of resources.Which of the following BEST describes this attack?
Question168: A security analyst is generating a list of recommendations for the company's insecure API. Which of the following is the BEST parameter mitigation rec
Question169:
Question170:
Question171:
Question172: A security analyst has observed several incidents within an organization that are affecting one specific piece of hardware on the network. Further investigation reveals the equipment vendor previously released a patch.Which of the following is the MOST appropriate threat classification for these incidents?
Question173:
Question174: A security analyst needs to obtain the footprint of the network. The footprint must identify the following information;* TCP and UDP services running on a targeted system* Types of operating systems and versions* Specific applications and versionsWhich of the following tools should the analyst use to obtain the data?
Question175: An organization prohibits users from logging in to the administrator account. If a user requires elevated permissions. the user's account should be part of an administrator group, and the user should escalate permission only as needed and on a temporary basis. The organization has the following reporting priorities when reviewing system activity:* Successful administrator login reporting priority - high* Failed administrator login reporting priority - medium* Failed temporary elevated permissions - low* Successful temporary elevated permissions - non-reportableA security analyst is reviewing server syslogs and sees the following:Which of the following events is the HIGHEST reporting priority?
